PHP php_handle_iff function denial of service

php-phphandleiff-dos (19920)

Low Risk

Description:

PHP is vulnerable to a denial of service attack, caused by a vulnerability in the php_handle_iff() function in the ext/standard/image.c. By sending a specially-crafted image to the getimagesize() PHP routine, a remote attacker could cause PHP to enter into an infinite loop to consume 100% of the available CPU resources, resulting in a denial of service.

Consequences:

Denial of Service

Remedy:

Upgrade to the latest version of PHP (5.0.4 or later), available from the PHP Web site. See References.

For SUSE Linux:
Upgrade to the latest version of php4 or php5, as listed below. Refer to SUSE Security Announcement SUSE-SA:2005:023 for more information. See References.

x86 Platform:
SUSE Linux 9.3: 4.3.10-14.2 or 5.0.3-14.2 or later
SUSE Linux 9.2: 4.3.8-8.5 or later
SUSE Linux 9.1: 4.3.4-43.28 or later
SUSE Linux 9.0: 4.3.3-187 or later
SUSE Linux 8.2: 4.3.1-176 or later

x86-64 Platform:
SUSE Linux 9.3: 4.3.10-14.2 or later
SUSE Linux 9.2: 4.3.8-8.5 or later
SUSE Linux 9.1: 4.3.4-43.28 or later
SUSE Linux 9.0: 4.3.3-187 or later

For Red Hat Linux:
Refer to RHSA-2005:406-11 or RHSA-2005:405-06 for patch, upgrade, or suggested workaround information. See References.

For Gentoo Linux:
Refer to Gentoo Linux Security Announcement GLSA 2005-04-15 for patch, upgrade, or suggested workaround information. See References.

For Ubuntu Linux:
Refer to USN-105-1 for patch, upgrade, or suggested workaround information. See References.

For other distributions:
Contact your vendor for upgrade or patch information.

References:

• CIAC INFORMATION BULLETIN P-197: PHP Security Bugs.
• iDEFENSE Security Advisory 03.31.05: PHP getimagesize() Multiple Denial of Service Vulnerabilities.
• PHP Web site: PHP 5.0.4 and 4.3.11 Released.
• BID-12962: PHP Group PHP Image File Format Remote Denial Of Service Vulnerability
• CVE-2005-0524: The php_handle_iff function in image.c for PHP 4.2.2, 4.3.9, 4.3.10 and 5.0.3, as reachable by the getimagesize PHP function, allows remote attackers to cause a denial of service (infinite loop) via a -8 size value.
• GLSA-200504-15: PHP: Multiple vulnerabilities
• MDKSA-2005:072: Updated php packages fix multiple vulnerabilities
• OSVDB ID: 15183: PHP getimagesize() php_handle_iff() Function DoS
• RHSA-2005-405: PHP security update
• RHSA-2005-406: PHP security update
• SA14792: PHP Multiple Vulnerabilities
• SECTRACK ID: 1013619: PHP Infinite Loops in getimagesize() Lets Users Deny Service
• SUSE-SA:2005:023: php4 php5: remote denial of service

Platforms Affected:

• Canonical Ubuntu 4.10
• Gentoo Linux
• MandrakeSoft Mandrake Linux 10.0
• MandrakeSoft Mandrake Linux 10.0 AMD64
• MandrakeSoft Mandrake Linux 10.1
• MandrakeSoft Mandrake Linux 10.1 X86_64
• MandrakeSoft Mandrake Linux LE2005
• MandrakeSoft Mandrake Linux LE2005 X86_64
• MandrakeSoft Mandrake Linux Corporate Server 2.1
• MandrakeSoft Mandrake Linux Corporate Server 2.1 X86_64
• MandrakeSoft Mandrake Linux Corporate Server 3.0
• MandrakeSoft Mandrake Linux Corporate Server 3.0 X86_64
• PHP PHP 4.2.2
• PHP PHP 4.3.10
• PHP PHP 4.3.9
• PHP PHP 5.0.3
• RedHat Enterprise Linux 3 AS
• RedHat Enterprise Linux 3 ES
• RedHat Enterprise Linux 3 WS
• RedHat Enterprise Linux 3 Desktop
• RedHat Enterprise Linux 4 Desktop
• RedHat Enterprise Linux 4 WS
• RedHat Enterprise Linux 4 AS
• RedHat Enterprise Linux 4 ES
• SuSE Linux Enterprise Server 8
• SUSE SuSE Linux 8.2
• SUSE SuSE Linux 9.0
• SUSE SuSE Linux 9.1
• SUSE SuSE Linux 9.2
• SUSE SuSE Linux 9.3
• SuSE SuSE SLES 9
• Turbolinux Turbolinux 10 Desktop
• Turbolinux Turbolinux 10 F...
• Turbolinux Turbolinux 10 Server
• Turbolinux Turbolinux 7 Server
• Turbolinux Turbolinux 7 Workstation
• Turbolinux Turbolinux 8 Server
• Turbolinux Turbolinux 8 Workstation
• Turbolinux Turbolinux Home
• Turbolinux Turbolinux Appliance Server 1.0 Hosting Ed
• Turbolinux Turbolinux Appliance Server 1.0 Workgroup Ed

Reported:

Mar 31, 2005

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page